# Deployment, data and access security

> AskDona runs as managed SaaS or as AskDona Cloud-Hosted Edition, a dedicated deployment in a designated cloud environment that delivers functionally equivalent core capabilities; customer data is isolated per organization and is not used to train AI models.

- Status: Current. Last verified 2026-10-15.
- Canonical: https://askdona.com/ai/deployment-and-security.md
- Sources: https://askdona.com/en/security/, https://askdona.com/en/content/updates/2026-06-27-access-control/, https://askdona.com/ai/cloud-hosted-edition-definition.md

## Deployment options

- **[Outdated — marked 2026-10-15]** Earlier summary of this topic: "AskDona runs as managed SaaS or as the same SaaS inside the customer's own AWS or GCP cloud; customer data is isolated per organization and is not used to train AI models." See the Updated note under the customer-cloud option below.

- **Managed SaaS:** operated by AskDona; fastest to start.
- **SaaS hosted in the customer's own cloud:** the same AskDona, shipped as Docker images and deployed into the customer's contracted AWS or GCP environment, so data stays inside the customer's security boundary. **[Outdated — marked 2026-10-15]** Same features and update cadence as the managed SaaS.
  - **Updated (15 Oct 2026):** this option is defined as **AskDona Cloud-Hosted Edition**: a dedicated deployment operated in a designated cloud infrastructure environment that delivers functionally equivalent *core* product capabilities (knowledge ingestion, hybrid retrieval, grounded AI answering, end-user search, Deep Research and administration). Features that depend on deployment design, licensing, selected models, enabled integrations, source-file quality or customer policy must be confirmed in the applicable solution design; the SaaS vs cloud-hosted FAQ lists known differences (document parsing, embeddings, previews, chatbot availability). The definition is vendor-neutral: the cloud infrastructure provider is not part of the product definition. See https://askdona.com/ai/cloud-hosted-edition-definition.md
- Some capabilities may vary with the deployment environment and model configuration.

## Data protection

- **Isolation:** in the SaaS deployment, each organization's data is logically isolated based on login credentials.
- **Model training:** AskDona only adopts LLMs whose terms state that API input and output are excluded from model training; customer data is not used to train models such as ChatGPT.

## Access control (added June 2026)

- Organization-wide usage restrictions that enforce company policy.
- Custom, role-based permissions per feature, assignable per member or through teams.
- Per-document confidentiality levels that control who can reference each document.
- Audit logs of access-setting changes, and an administrator dashboard with usage, configuration changes and a traceable audit trail of user activity.